I've previously successfully set up Exchange 2010 with a wildcard certificate, but I remember it wasn't exactly straightforward. I'm also more familiar with generating CSRs with openssl than Windows tools. My question is in two parts:

  1. would life be simpler if I did not use a wildcard cert?
  2. can I use a certificate in Exchange if I've had it issued against a CSR generated with openssl?

We use a web-based front-end to OpenSSL to generate the CSR and private key, and the same tool to build the PFX from the key and issued certificate. Works great.

NOTE: A configuration change is required for legacy clients if you use a wildcard certificate: http://technet.microsoft.com/en-us/library/cc535023(v=exchg.80).aspx

You can either generate a wildcard certificate for your email domain, or a unified communications/SAN certificate. If you aren't sure which subject alternative names to include in the UC certificate, you may want to use the wizard in the EMC to generate your CSR. Be sure to include any publicly accessible client-access hostnames and autodiscover.domain.com. Also include your send connector FQDNs if you want to utilize TLS for transport.

  • does this achieve the same thing as your tool? – Jack Douglas Apr 10 '13 at 17:11
  • hard to see links in comments here isn't it? – Jack Douglas Apr 10 '13 at 17:12
  • 1
    It is hard to see links in comments, which is why I've resorted to pasting URLs instead of hyperlinking. It looks like they do use the same parameters: /usr/bin/openssl pkcs12 -export -in /path/to/server.crt -inkey /path/to/server.key -certfile /path/to/cabundle.crt -out /path/to/new/server.pfx -passout file:/path/to/password.txt – Jeremy Lyons Apr 10 '13 at 17:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.